[java-identity-provider] branch main updated: IDP-2216 - Option to randomize FriendlyName
Scott Cantor
cantor.2 at osu.edu
Mon Dec 18 18:39:11 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d17e0da9cf5e54d988e99db2fdd48c4dbfa72bfa
The following commit(s) were added to refs/heads/main by this push:
new d17e0da9c IDP-2216 - Option to randomize FriendlyName
d17e0da9c is described below
commit d17e0da9cf5e54d988e99db2fdd48c4dbfa72bfa
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Dec 18 13:39:08 2023 -0500
IDP-2216 - Option to randomize FriendlyName
https://shibboleth.atlassian.net/browse/IDP-2216
Not random, but this appends the assertion ID to the values.
---
.../shibboleth/idp/conf/relying-party-mddriven.xml | 16 +++++++
.../config/AttributeQueryProfileConfiguration.java | 44 ++++++++++++++++++
.../config/BrowserSSOProfileConfiguration.java | 13 ++++++
...andomizeFriendlyNameProfileConfigPredicate.java | 54 ++++++++++++++++++++++
.../impl/AttributeQueryProfileConfiguration.java | 43 ++++++++++++++++-
.../impl/BrowserSSOProfileConfiguration.java | 33 +++++++++++++
.../impl/AddAttributeStatementToAssertion.java | 14 +++++-
7 files changed, 214 insertions(+), 3 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
index 923f978a0..5061b6306 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
@@ -459,6 +459,14 @@
<constructor-arg value="false" />
</bean>
</property>
+ <property name="randomizeFriendlyNamePredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="randomizeFriendlyName" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
<property name="proxyCountLookupStrategy">
<bean parent="shibboleth.MDDrivenIntProperty" p:propertyName="proxyCount" />
</property>
@@ -670,6 +678,14 @@
</constructor-arg>
</bean>
</property>
+ <property name="randomizeFriendlyNamePredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="randomizeFriendlyName" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
</bean>
<bean id="SAML2.ArtifactResolution.MDDriven" parent="AbstractMDDrivenSAML2Profile" lazy-init="true"
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
new file mode 100644
index 000000000..86e7b5d7b
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.saml2.profile.config;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.shared.annotation.ConfigurationSetting;
+
+/**
+ * Configuration support for SAML 2.0 Attribute Query profile.
+ *
+ * <p>Adds settings specific issuer role for SAML 2.0.
+ *
+ * @since 5.1.0
+ */
+public interface AttributeQueryProfileConfiguration
+ extends net.shibboleth.saml.saml2.profile.config.AttributeQueryProfileConfiguration {
+
+ /**
+ * Gets whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to
+ * enable probing of invalid behavior by relying parties.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff the FriendlyName should be randomized
+ */
+ @ConfigurationSetting(name="randomizeFriendlyName")
+ boolean isRandomizeFriendlyName(@Nullable final ProfileRequestContext profileRequestContext);
+
+}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index 745636ea4..b31f443e6 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -72,6 +72,19 @@ public interface BrowserSSOProfileConfiguration
@ConfigurationSetting(name="skipEndpointValidationWhenSigned")
boolean isSkipEndpointValidationWhenSigned(@Nullable final ProfileRequestContext profileRequestContext);
+ /**
+ * Gets whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to
+ * enable probing of invalid behavior by relying parties.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff the FriendlyName should be randomized
+ *
+ * @since 5.1.0
+ */
+ @ConfigurationSetting(name="randomizeFriendlyName")
+ boolean isRandomizeFriendlyName(@Nullable final ProfileRequestContext profileRequestContext);
+
/**
* Gets the unmodifiable collection of audiences for a proxied assertion.
*
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/RandomizeFriendlyNameProfileConfigPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/RandomizeFriendlyNameProfileConfigPredicate.java
new file mode 100644
index 000000000..47f2b6aad
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/RandomizeFriendlyNameProfileConfigPredicate.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.saml2.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.idp.saml.saml2.profile.config.AttributeQueryProfileConfiguration;
+import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * A predicate that evaluates a {@link ProfileRequestContext} and extracts the effective
+ * setting of {@link BrowserSSOProfileConfiguration#isRandomizeFriendlyName(ProfileRequestContext)}
+ * or {@link AttributeQueryProfileConfiguration#isRandomizeFriendlyName(ProfileRequestContext)}.
+ *
+ * <p>Defaults to false.</p>
+ *
+ * @since 5.1.0
+ */
+public class RandomizeFriendlyNameProfileConfigPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final ProfileRequestContext input) {
+
+ final RelyingPartyContext rpc = getRelyingPartyContext(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof BrowserSSOProfileConfiguration sso) {
+ return sso.isRandomizeFriendlyName(input);
+ } else if (pc instanceof AttributeQueryProfileConfiguration query) {
+ return query.isRandomizeFriendlyName(input);
+ }
+ }
+
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java
index f9a1406e2..db45bbe98 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java
@@ -14,20 +14,29 @@
package net.shibboleth.idp.saml.saml2.profile.config.impl;
+import java.util.function.Predicate;
+
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate;
import org.opensaml.profile.logic.NoIntegrityMessageChannelPredicate;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
/** Configuration support for IdP SAML 2.0 attribute query profile. */
public class AttributeQueryProfileConfiguration extends AbstractSAML2AssertionProducingProfileConfiguration
- implements net.shibboleth.saml.saml2.profile.config.AttributeQueryProfileConfiguration {
+ implements net.shibboleth.idp.saml.saml2.profile.config.AttributeQueryProfileConfiguration {
/** Name of profile counter. */
@Nonnull @NotEmpty public static final String PROFILE_COUNTER = "net.shibboleth.idp.profiles.sam2.query.attribute";
-
+
+ /** Whether the FriendlyName attribute should be randomized when encoding Attributes. */
+ @Nonnull private Predicate<ProfileRequestContext> randomizeFriendlyNamePredicate;
+
/** Constructor. */
public AttributeQueryProfileConfiguration() {
this(PROFILE_ID);
@@ -42,6 +51,36 @@ public class AttributeQueryProfileConfiguration extends AbstractSAML2AssertionPr
super(profileId);
setSignResponsesPredicate(new NoIntegrityMessageChannelPredicate());
setEncryptAssertionsPredicate(new NoConfidentialityMessageChannelPredicate());
+ randomizeFriendlyNamePredicate = PredicateSupport.alwaysFalse();
+ }
+
+ /** {@inheritDoc} */
+ public boolean isRandomizeFriendlyName(@Nullable final ProfileRequestContext profileRequestContext) {
+ return randomizeFriendlyNamePredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to
+ * enable probing of invalid behavior by relying parties.
+ *
+ * @param flag flag to set
+ *
+ * @since 5.1.0
+ */
+ public void setRandomizeFriendlyName(final boolean flag) {
+ randomizeFriendlyNamePredicate = PredicateSupport.constant(flag);
+ }
+
+ /**
+ * Set condition to determine whether to randomize/perturb the FriendlyName attribute when encoding
+ * SAML 2.0 Attributes to enable probing of invalid behavior by relying parties.
+ *
+ * @param condition condition to set
+ *
+ * @since 5.1.0
+ */
+ public void setRandomizeFriendlyNamePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ randomizeFriendlyNamePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
index 078a5fb54..4e5440463 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
@@ -76,6 +76,9 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
/** Whether the response endpoint should be validated if the request is signed. */
@Nonnull private Predicate<ProfileRequestContext> skipEndpointValidationWhenSignedPredicate;
+ /** Whether the FriendlyName attribute should be randomized when encoding Attributes. */
+ @Nonnull private Predicate<ProfileRequestContext> randomizeFriendlyNamePredicate;
+
/** Lookup function to supply proxyCount property. */
@Nonnull private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
@@ -163,6 +166,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
forceAuthnPredicate = new ProxyAwareForceAuthnPredicate();
checkAddressPredicate = PredicateSupport.alwaysTrue();
skipEndpointValidationWhenSignedPredicate = PredicateSupport.alwaysFalse();
+ randomizeFriendlyNamePredicate = PredicateSupport.alwaysFalse();
proxyCountLookupStrategy = FunctionSupport.constant(null);
proxyAudiencesLookupStrategy = FunctionSupport.constant(null);
proxiedAuthnInstantPredicate = PredicateSupport.alwaysTrue();
@@ -342,6 +346,35 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
skipEndpointValidationWhenSignedPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /** {@inheritDoc} */
+ public boolean isRandomizeFriendlyName(@Nullable final ProfileRequestContext profileRequestContext) {
+ return randomizeFriendlyNamePredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to
+ * enable probing of invalid behavior by relying parties.
+ *
+ * @param flag flag to set
+ *
+ * @since 5.1.0
+ */
+ public void setRandomizeFriendlyName(final boolean flag) {
+ randomizeFriendlyNamePredicate = PredicateSupport.constant(flag);
+ }
+
+ /**
+ * Set condition to determine whether to randomize/perturb the FriendlyName attribute when encoding
+ * SAML 2.0 Attributes to enable probing of invalid behavior by relying parties.
+ *
+ * @param condition condition to set
+ *
+ * @since 5.1.0
+ */
+ public void setRandomizeFriendlyNamePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ randomizeFriendlyNamePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
/** {@inheritDoc} */
@Nullable public Integer getProxyCount(@Nullable final ProfileRequestContext profileRequestContext) {
final Integer count = proxyCountLookupStrategy.apply(profileRequestContext);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java
index 0bbd06f3f..fdef694dd 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java
@@ -43,6 +43,7 @@ import net.shibboleth.idp.attribute.IdPAttribute;
import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.saml.profile.impl.BaseAddAttributeStatementToAssertion;
+import net.shibboleth.idp.saml.saml2.profile.config.logic.RandomizeFriendlyNameProfileConfigPredicate;
import net.shibboleth.shared.annotation.constraint.NullableElements;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.service.ServiceException;
@@ -107,7 +108,18 @@ public class AddAttributeStatementToAssertion extends BaseAddAttributeStatementT
assertion.getAttributeStatements().add(statement);
- log.debug("{} Adding constructed AttributeStatement to Assertion {} ", getLogPrefix(), assertion.getID());
+ final boolean randomizeFriendlyName =
+ new RandomizeFriendlyNameProfileConfigPredicate().test(profileRequestContext);
+ final String id = assertion.getID();
+ if (randomizeFriendlyName && id != null) {
+ log.debug("{} Will randomize FriendlyName attributes", getLogPrefix());
+ for (final Attribute a : statement.getAttributes()) {
+ final String current = a.getFriendlyName();
+ a.setFriendlyName(current != null ? current + id : id);
+ }
+ }
+
+ log.debug("{} Adding constructed AttributeStatement to Assertion {} ", getLogPrefix(), id);
} catch (final AttributeEncodingException e) {
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.UNABLE_ENCODE_ATTRIBUTE);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list